H Ui
Monthly
Command injection in h-ui v0.0.25 and earlier allows an authenticated administrator to execute arbitrary OS commands as root by supplying shell metacharacters in the 'listen' configuration field of the administrative API. Because the application builds nftables/iptables rule strings with fmt.Sprintf and runs them through bash -c with root privileges, a successful injection yields full host compromise with high confidentiality, integrity, and availability impact. Exploitation requires valid administrative credentials plus the ability to set the listen field, so realistic risk concentrates on multi-operator or weakly-secured panels; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch has been identified.
Command injection in h-ui v0.0.25 and earlier allows an authenticated administrator to execute arbitrary OS commands as root by supplying shell metacharacters in the 'listen' configuration field of the administrative API. Because the application builds nftables/iptables rule strings with fmt.Sprintf and runs them through bash -c with root privileges, a successful injection yields full host compromise with high confidentiality, integrity, and availability impact. Exploitation requires valid administrative credentials plus the ability to set the listen field, so realistic risk concentrates on multi-operator or weakly-secured panels; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch has been identified.